Loading story…
Cisco released security updates for CVE-2024-20399, a zero-day command injection flaw in NX-OS that was actively exploited against Cisco Nexus and Cisco MDS 9000 switches. The vulnerability stems from insufficient validation of CLI arguments and allows a local authenticated attacker with administrator privileges to execute arbitrary code as root, creating a high-impact path to full device compromise on affected network infrastructure.
Cisco and Sygnia linked the in-the-wild exploitation to the China-nexus threat group Velvet Ant, which used the flaw to deploy malware that enabled remote access, file uploads, and execution of additional malicious code on compromised switches. Defenders were urged to patch affected devices immediately and review exposed administrative access, as the attacks targeted core switching platforms that can provide durable, stealthy footholds inside enterprise environments.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco released security updates for Nexus and MDS series network switches to remediate CVE-2024-20399, a zero-day caused by insufficient validation of CLI arguments that can let an authenticated administrator execute arbitrary code as root.
Cisco and Sygnia reported that the China-nexus threat group Velvet Ant successfully exploited CVE-2024-20399, a command injection zero-day in Cisco NX-OS, to install malware that enabled remote access, file upload, and malicious code execution on affected switches.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released fixes for nine vulnerabilities across Nexus 9000 switches, IOS XR, SIP software, and selected collaboration endpoints. The most severe, **CVE-2026-20212** (CVSS 9.8), affects certain Silicon One-based Nexus 9000 switches: unauthenticated remote attackers can send crafted traffic to TCP ports 43210 or 43211 exposed through the default Layer 3 VRF and execute code as root. Cisco also patched critical IOS XR and Nexus flaws, including **CVE-2026-20274** and **CVE-2026-20279**, which can enable remote code execution or authentication bypass, and fixed the high-severity phone denial-of-service issue **CVE-2026-20281**. Cisco separately warned that **CVE-2026-20354** and **CVE-2026-20355** remain unpatched in Secure Email appliances running AsyncOS 16.5.0 or earlier with S/MIME enabled. A man-in-the-middle attacker able to intercept and alter gateway traffic could recover plaintext from encrypted email communications. Cisco reported no known public exploitation of the patched flaws or the Secure Email issues; organizations should promptly deploy applicable NX-OS, IOS XR, and other Cisco updates, while restricting access to ports 43210 and 43211 with infrastructure ACLs or port blocks until Nexus systems can be upgraded.
Sep 9, 2026
Cisco published security advisories for two enterprise management platforms: a cross-site scripting (**XSS**) flaw in **Cisco Catalyst SD-WAN Manager** and a server-side request forgery (**SSRF**) flaw affecting **Cisco Nexus Dashboard** and **Cisco Nexus Dashboard Insights**. The issues affect products used to centrally manage networking infrastructure, raising the risk that attackers could target administrative interfaces and backend request handling in high-value environments. The advisories identify separate web-application security weaknesses in Cisco's network management stack, with one issue tied to malicious script execution in the SD-WAN management interface and the other to unauthorized server-side requests from Nexus Dashboard components. Organizations using these platforms should review Cisco's product advisories, determine affected deployments, and prioritize remediation or mitigations for exposed management systems.
Jun 29, 2026
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Aug 31, 2026